EP0172868A1 - Virtual address to real address conversion - Google Patents

Abstract

A computer has a main control unit (MCU) interposed between a main memory (M) and the processor (CPU), the address and data buses (ABUS and DBUS) coming from the CPU being connected to the MCU which is connected to the main memory (M) via a secondary address and data bus (ABUS 2). Control signals for reading and writing to the CPU are applied to the MCU. The MCU produces its own secondary read and write signals (R2 and W2) by reading and writing to the main memory. The MCU contains an internal memory for a data descriptor table (DT), a set of internal index registers (XRO-XRQ), three arithmetic circuits (AC1-AC3), a mode decoder (MD), a decoder register register (XDEC), mask and offset unit (MSU) and range conversion and control unit (RCU). The virtual address output by the CPU on the address bus (ABUS) consists of two parts, the first being used to indicate one of the possible entries in the data descriptor table (DT) necessary for the translation of virtual addresses sent by the CPU on the address bus (ABUS) into real addresses sent by the MCU to the main memory on the secondary address bus (ABUS 2) and a second part containing a mode indicator allowing the modification of the logical processes of the MCU when it performs address translation. The data descriptor table contains at least one entry on each element or data structure addressable in the main memory (M), the actual entry being indicated using an address decoder (ADEC 1). The arrangement is such that the processor produces virtual addresses and the main controller converts the virtual addresses into real addresses in the main memory, the main command being able to execute any address calculation or any multiplication of index regardless of program functions.

Description

VIRTUAL ADDRESS TO REAL ADDRESS CONVERSION

This invention relates to computers and is particularly concerned with the performance and reliability of computer systems including a standard CPU,such as the Motorola MC 68000, INTEL iAPX 286, etc,and the memory accessed from such CPUs. The invention allows machine instructions of a standard CPU to be utilized in a much more efficient and reliable way than is otherwise possible.

This invention provides a computer having a central processor, main memory means for storage of information in binary form in real addresses in the memory, the processor issuing virtual addresses and a master controller being provided for converting virtual addresses issued by the processor into real addresses in the main memory the master controller incorporating means for performing any address calculation or index multiplication independent of any program function.

More specifically the invention provides a computer having a central processing unit, a main memory for storage of information in binary form and a master control unit for performing translation of a virtual address issued by the central processing unit to the master control unit into a real address issued by the master control unit to the main memory by reading of information from an internal memory of the- master control unit containing data descriptor table with at least one table entry for each individually accessible data.element in the main memory, three elements of each description table entry being assigned for virtual address translation purposes, one of which elements permits either one out of a set of internal index registers of the master control unit to be indicated for participation in the address translation or indicates that none of these index registers participates in said translation, the second of which elements permits the starting address in the main memory to be specified in the case that no index register participates in the address translation and permits a secondary table entry to be indicated in the case that an index register participates in the address translation, and the third of which elements permits the size of the element to be accessed to be specified in the case that an index register does not participate in the address translation and permits the size of an element to participate in an index multiplication to be specified in the case when an index register does participate, and which master control unit also includes two decoders, the first one of which allows one of the index registers of the master control unit to be selected or indicates that none is selected and the second of which allows the activities performed by the master control unit to be controlled, and further includes two arithmetic circuits, one of which performs an index multiplication of the contents of the index register indicated by the output of the first decoder by the contents of the third element of the currently indicated descriptor tabel entry in a cumulative fashion so that the resulting value is added to the result of a previous index multiplicication within the same address , either performs the addition of the actual start address held in the second element of a descriptor table entry to the result of the first arithmetic circuit if no index register is indicated by the first element of the indicated descriptor table entry or causes the address translation to be continued in a cumulative fashion with the table entry indicated by the second element of the current descriptor table entry. There now follows a general description of the technical background to the invention followed by a detailed description of some specific embodiments of the invention with references to the accompanying drawings. Fig. 1 shows a simplified block diagram of a computing system. This system is not the subject of the invention, but introduced in order to be able to explain the background to, and the salient points of, the invention. The main parts of the computing system in Pig 1 are the Central Processing Unit (CPU), the Memory (M), and the Input/Output Interface (10) to the external world. The CPU contains a Control Logic function (CL), which is not described in detail, and four registers; a Program Counter register (PC,) an Address Register (AR), a Data Register (DR) and an Instruction Register (IR). The information stored in these registers can be read and written by CL. The memory (M) contains N memory words (MW_Q, MW^, .. MW_fj^), and an Address Decoder (AD), the input of which is connected to the Program Counter (PC) and the Address Register (AR) of the CPU. Each memory word contains a specific number of binary memory elements, each one of which may store either the information 0 or 1. All the memory words are connected to the Data Register (DR) of the CPU, i.e. the contents of any memory word may be transferred to DR and vice versa. The Control Logic (CL) of the CPU has two control outlets, a Read Outlet (R) and a Write Outlet (W), which are connected to all the memory words in parallel. When CL issues a Read command, the Address Decoder (AD) selects the Memory Word, which corresponds to the contents of the Address Register (AR) or the Program Counter (PC), and the R Control Outlet from CL enables the transfer of information from the selected memory word into the Data Register (DR) if the address is obtained from the Address Register (AR), and into the Instruction Register (IR) if the address is obtained from the Program Counter (PC). If a Write Command is issued, the W Control Outlet from CL enables the transfer of information from the Data Register (DR) into the memory word addressed by the Address Register (AR).

The information stored in the memory words can be used in two different ways, either as data or as control instructions.

When the information stored in a memory word is used as data, the separate binary memory elements are combined together to form a single value (V_m) according manipulated by the CL in the desired manner, e.g. arithmetic operations, logic operations, etc. For a memory word MW_χ containing m binary memory elements or bits, the total number of different data values represented by different combinations of the m bits, which can be stored in the memory word is 2^m. These bit combinations may be used to represent values ranging from

0 to 2^m-l as illustrated by the example of the possible values for a 4-bit memory word in Fig. 2b. In special cases (e.g. binary coded decimal values) the value range may be further restricted. It is to be noted, that the manipulation of data values in CL will give the correct result only as long as the result values do not exceed the number of bits, which can be manipulated and stored. In a system with 4—bit memory words and 4-bit control logic the addition 8+8 would give the result 0 instead of 16, because the representation of 16 in a four bit system would be 0. It is also to be noted that the information may be coded so that the most significant bit is used as a sign bit with, for instance, positive values denoted by the value 0 and negative values by the value 1. The value range of a four bit variable would, in this case be -8 to +7, i.e. still 16 values. Other coding schemes are, of course, also possible.

Memory words used for data storage purposes are usually randomly accessed, i.e. no implicit relationship exists between the address of one data word and another data word. In order to access a data word, the address of the word has to be transferred into the Address Register

(AR). Thereafter the contents of the word can be read into the Data Register (DR), or the contents of the Data

Register (DR) can be stored into the memory word. It is to be noted that it is possible to build explicit relationships between data words. One possibility is the sequential array, i.e. a number of consecutive memory words, which contains related information and which can be accessed by setting the Address Register to, for instance, the first word in the array and then incrementing the Address Register to access consecutive words in the array. Another possibility is the chaining of data elements, i.e. storing the address of one memory word, as information, in another memory word. In order to access such an indirectly addressed memory word, the information from the first word is first read into the Data Register (DR), and then via CL transferred to the Address Register (AR).

A program consists of a number of sequentially executed Machine Instructions. It is therefore natural, that the memory words used to store the Machine Instructions of a program also follow one another sequentially. The sequential execution of Machine

Instructions stored in consecutive memory words is the normal mode of operation and therefore built into the . containing Control Instructions the Program Counter (PC) is used to select the memory word to be read. The information is then transferred to the Instruction Register (IR), where CL can access and evaluate the instruction. Each time a Machine Instruction is read from the memory, the Program Counter is automatically incremented so that control instructions are read in consecutive order. When a Machine Instruction has been read into the

Instruction Register the Control Logic (CL) first decodes the instruction. Depending on how the decoding is performed the bits of an instruction form bit groups, where each bit group has a separate meaning (and may even overlap each other in some cases). Fig. 3 illustrates a simplified example of instruction decoding in a memory word M p, where it has been assumed, that instructions contain three bit groups, a Command Code group (CC) and two Operand bit groups (0P1) and (0P2). The Command Code determines the actual instruction to be executed and the operands specific parameters of that execution. It is for instance possible to give a memory address as 0P1 and a data value as 0P2 with the command code of the instruction specifying writing into memory (Store Data - SD instruction). The Control Logic (CL) will then perform the following activities: Transfer OP1 into the AR register of Figure 1.

Transfer OP2 into the DR register of Figure 1.

Assert the W control signal to the memory M, whereby the information in DR will be written into the memory word addressed by AR.

Increment the PC register to prepare execution of the next instruction.

Another example is the case where OP1 gives a memory address and the command code specifies a 'jump* (JP instruction). In this case the control logic performs the single activity:

Transfer 0P1 into the PC register, thereby preparing for execution of the next instruction at the specified memory word.

The number of operands used in any particular instruction may vary with the instruction as already illustrated by the two examples above. Some instructions use no operands at all. Some instructions may even require three or four operands.

Gradually the general computer system structure in Fig. 4 has evolved, which structure is now taken for granted in practically all types of conventional computing systems The hardware consists of the Central

Processing Unit (CPU) with its set of Machine ns ruc ons , e emory an e n er ace o the external world (10). In Fig. 4 the Data Flow and

Control Flow relationships are shown, where each such relationship assumes the existence of a hardware connection. The Memory (M) is normally accessed by the

CPU, but can also, if necessary be accessed directly from the 10 hardware without the CPU being involved. The software, which resides in the memory M, consists of the

Application Programs (AP), the Input/Output Interface Programs (I0P), the Operating System (OS) and the Data

Base (DB).

The Machine Instructions (MI) consists of the set of instructions, which are executable within the CPU and generally available for the design of any program (OS, AP, IOP).

The Data Base (DB) contains all of the data for the system, which data can be read and written by the CPU under the control of the various programs.

The Interface Programs (IOP) are a set of programs specifically designed to control the actual types of peripheral devices (10) used in the interworking with the external world. The Interface Programs are called either from the Master Scheduler (MS) or from the

Application Programs (AP), and can themselves call Utility Subprograms.

The Application Programs (AP) are a set of user specific programs, which have been designed to solve specific application problems (e.g. αiiiβreiiw tyt«β »*_*■ computation). Application Programs called from the Master

Scheduler and may call Utility subprograms and Interface

Programs. Finally, the Operating System is the application independent System Control Program, which contains two parts, the Master Scheduler (MS), and the Utility

Subprograms (US). The Master Scheduler (MS) is usually driven by means of Interrupt Signals (IS), and controls the execution of all other programs in the entire system. The Utility Subprograms (US) are a set of generally available subprograms, which have been developed to solve problems of a general nature, but which are too complex to be performed by means of single Machine Instructions. The Utility Subprograms can be called from any type of programs (OS, AP, or IOP).

Fig. 5 shows a block diagram of the principal software structure, which is based on the hardware/software system structure in Fig. 4, and which is currently considered to be the basic software structure in conventional software technology. The software is split into two types of units, data and programs. The data of a system consist of individual data elements and structures (DE) located in the Data Base (DB) of the system. The programs consist of Operating System programs (OS), Application Programs (AP) and Input/Output Programs (IOP). Both AP, IOP and US contain Machine Instructions of the actual computer.

Fig. 6 shows an example of a typical layout of memory, which corresponds with the software structure in Fig. 5. Certain areas of the memory is dedicated to the

Operating System with its programs, tables and other data areas, to which the user software have no access in principle. Other areas of the memory are dedicated to the exclusive storage of the Data Base, within which areas some subareas are dedicated exclusively to a particular user, some exclusively to another user, some dedicated to the exclusive use of several particular users and some areas being used by any and all programs (including Operating System, IOP, Utility Subprograms etc.-). Still other areas of the memories are used for programs of any type, some of which again are dedicated exclusively to a single user and some which are common for several users up to, and including, all users (common subprograms and common data). A system which is implemented according to the principles shown in Figure 6 will experience a number of problems, which are more or less interrelated. One of these problems is the administration and management of the user software. As illustrated by Figure 6 each user has a number of program and data areas, which directly belong to him, and a number of program and data areas, which do not belong to him, but which he nevertheless may use or access. When a new user software unit is to introduced into an existing system, then space must be reserved for each of the areas, which is exclusive for that software unit. Secondly it must be known whether any area used jointly with other software units is already in existence within the system. In that case that area need to be linked to the rest of the areas accessible from that software unit. If no other software unit currently exists, which needs the use of a jointly used area, then this area needs to be allocated before linking may be done. The reverse problem of course exists when a software unit is to be removed from a system, i.e. in this case the exclusive areas may easily be removed. However, any joint area may only be removed if no other user requiring this area exists.

Due to present technological limitations and the ever present requirement to be able to achieve higher performance with existing computers one of the favored techniques for linking software areas together is by means of so called * pointers ' . Pointers are nothing more than absolute memory addresses stored as data in the memory itself and may, as such, be simply and efficiently processed by the computer and stored in the memory of the computer, both as fixed relationships in the programs and as variable relationships in the data areas. Figure 7 illustrates a representative example of possible pointer relationships for a single user. It is assumed that the Master Scheduler of the Operating System holds a master pointer to any U3er Program (exemplified by UPP1 in Figure 7). The User Programs then contain further pointers to subprograms and data as required.

The complexity of the problem of introducing software for any user into the system (and removing it from the system if and when required) now becomes apparent. In a system of the type illustrated in Figure 7 the only realistic way of solving the problem is by means of an Of -Line Support system, which keeps track of all absolute addresses in order to be able to generate the actual binary code to be stored as programs and data in the memory. This of course makes any run-time changes or modification of the software extremely difficult. Emergency procedures for this purpose (so called ^•patching* procedures) have been developed, but these cannot be considered to be satisfactory.

A second problem caused by the use of pointers is the reliability of the systems. Correct operation of any software system postulates a) that all the pointers are correctly calculated and b) that they remain so. Figure 8 shows an example of a user data structure in a memory where pointers are used. This user data structure is implemented as two separate rows of memory words, the first row containing the three logical data elements Cl located at memory address 35492, PI located at memory address 35493 and X located at memory address 35494, and the second row containing the five logical data elements

C2, C3, P2, P3 and Y located at the memory addresses

48373, 48374, 48375, 48376 and 48377. Each of the data element is used for a particular purpose, which often is reflected in the logical name, which is associated with the data element, e.g. Cl, C2 and C3 for element used as counters; PI, P2, and P3 for elements used as pointers, X and Y for general purpose data elements. In Figure 8 the two disjoint memory areas are shown to be linked via the two pointers PI and P2, where PI contains the address to the first memory word of the second memory area (48373) and P2 in turn contains the address to the first word of the first memory area (35492). - Assuming that an externally obtained pointer indicates one of the memory areas, then all of the memory words will be accessible by means of the suitable logic. This will be illustrated by means of the following example, where it is assumed that the following logic operations are to be performed in the indicated sequence:

Cl := Cl + 1 — Increment counter Cl

C2 := 02 ♦ 1 — Increment counter 02

C3 := C3 * 1 — Increment counter 03

Y := X — Transfer the contents of X to Y Assuming that the Address Register (AR) in Figure 1 has been set up to hold the address 35492 ( - the External

Pointer of Figure 8) prior to the execution of the program, and that the program itself resides at some addresses A, A+l, A+2, etc. in the memory, then the logic operations may be performed by a sequence of machine instructions:

A ADD 8AR.1 — Increment C1

A*1 D AR_f βAR+1 — Transfer P1 to AR

A*2 ADD βAR. 1 — Increment C2

A+3 ADD βAR+1, 1 — Increment C3

A+4 LD AR- βAR+2 — Transfer P2 to AR

A+5 LD DR. OAR+2 — Transfer X to DR

A+6 LD AR. €AR+1 — Transfer P1 to AR

A+7 SD DR- ΘAR+4 — Store DR in Y

The above program sequence is perfectly valid as long as the initial address given by the External Pointer (= 35492) at the program entry point is correct. However, assume that the External Pointer is incorrectly pointing to the address 35493. The effect of this will be as follows :-

(a) The instruction at address A, which was originally designed for the purpose of performing the operation Cl := Cl + 1, will now actually add 1 to the contents of the memory word at address 35493. Hence it will not be performing the operation

Cl := Cl + 1 at all, but instead be performing the equivalent of the operation PI :» PI + 1, thereby making PI contain the value 48374 instead of 48373.

(b) The instruction at address A+l originally designed for the purpose of reading the pointer PI prior to incrementing the counters C2 and C3 will now read the contents of the memory word at address 35494, i.e. it will perform the equivalent of reading and using the contents of the data element X as a pointer.

(c) The instructions at addresses A+2 and A+3 originally designed for the purpose of performing the operations C2 :=» C2 + 1 and C3 := C3 + 1 will now perform the operations on the memory at the addresses indicated by the current contents of the data element X. Because the contents of X varies with time, this means that two consecutive memory words at random will be incremented. In other words, random errors will be introduced into the system.

(d) The instruction sequence at addresses A+4 to A+7 designed for the purpose of performing the operation Y := X will now perform a transfer of information from a memory word outside the user area in Figure 8 (i.e. at address 35495) to a randomly indicated memory word.

The above type of software error introduced by executing otherwise correct programs with faulty pointers is defined as 'cross purpose memory accessing, because a memory word used for a specific purpose may now inadvertently be used for a completely different purpose. One of the worst characteristics of a system where cross purpose memory accessing is possible is that a single error 'breeds' new errors. The execution of the instruction sequence from A to A+7 above with the incorrect pointer value will for instance generate a total of 8 errors, five of which are inside the user area of Figure 15, i.e. Cl, C2 and C3 are left unincremented, the old value of Y is not overwritten by the value of X and the pointer PI is erroneously incremented where it should not have been incremented. If now the same sequence of instructions is executed a second time, this time with the correct input pointer value, then the instructions at the addresses from A+l to A+7 will generate new errors by virtue of the fact that PI now contains a faulty value left by the previous faulty execution. In this case C2 will not be incremented where it should. The instruction sequence which should have incremented C2 will now increment C3, thus by random chance generating the correct result and thereby actually masking the error. The instruction sequence which should have incremented C3 will now increment P2, thus again generating a potential new 'error breeder'. Finally, the instruction seque .nee by means of which the operation Y := X is realised will again generate an error outside the user area of Figure 8.

It should be evident, that any system, where cross purpose memory accessing is potentially possible, will work as long as no cross purpose memory accessing error is in existence within the system. However, it should be equally evident, that if even a single cross purpose memory accessing error can be introduced anywhere in the system, then correct operation of the system, both in parts and as a whole, can no longer be guaranteed. One of the consequences of this state of affairs is that if even one cross purpose memory accessing error is detected, then the probability is approaching Is that additional cross purpose memory accessing errors exist within the system. Hence the only practical means of restoring the system to a state where faultfree operation will be possible is to restart the entire system, i.e. to unconditionally interrupt the ongoing program execution, to reset all data areas to predefined values and thereafter to start program execution from a predefined restart point for the system as a whole. One of the known methods for detecting cross purpose memory accessing errors, once they have occurred is by means of so called 'Audit Programs' . Audit programs are periodically or on demand executed programs, which postulate the existence of implicit or explicitly introduced redundancies in the software. The pointer P2 in Figure 8 is one example of such an explicitly introduced redundancy. It is now possible to design an audit program which, given the External Pointer (= 35492) as input data, will address the memory word containing PI by adding 1 to the External Pointer, use the stored value of (the assumed) PI as a new pointer, add 2 to this value, thereby (assumedly) addressing P2, reading (the assumed) P2 and comparing this value with the original External Pointer. If no cross purpose accessing error exists within the areas checked and controlled by this audit program, then the values will match as they do in Figure 8. If a mismatch is indicated by an audit program, then the existence of at least one cross purpose memory accessing error is indicated. The system therefore will have to be restarted in order to clear the indicated error as well as any other existing but not detected cross purpose memory access error or any consequence thereof.

Cross purpose memory accessing errors may be caused by both software and hardware faults. It is therefore impossible to guard against cross purpose memory accessing errors purely by software means. One of the principles, which conventionally have been used to reduce the cross purpose memory accessing error problem, is to separate memory areas, which are used for different purposes, physically from each other by assigning each such area a characteristic set of properties, which are recognized by the hardware and therefore may be used for protection purposes.

Figure 9 illustrates an example of such a separation of memory areas with the following four types of memory areas —

Permanent Data Area A memory area containing data elements, which may be read by any program, but must not be written written into by any program during normal operation. A permanent data area may be assigned the Read Only (RO) property by hardware means.

Semipermanent Data Area - A memory area containing data elements, which may be read by any program, but may only be written into by certain programs, provided that explicitly defined security and verification measures are undertaken. A semipermanent data area may be assigned a Conditional Read Only (CRO) property by hardware means.

Transient Data Area A memory area containing data elements, which may be freely read and written by any program. A transient memory area has the basic Read/Write (RW) property.

»

Program Area A memory area containing executable programs or programs with embedded permanent data elements. A program area may therefore be assigned the Execute Only (E0) or the Execute and Read (ER) property.

By introducing separate instructions (or parameters of the instructions) for reading and writing of information from and into areas with different properties, it will now be possible to detect some of the cross purpose accessing errors when they actually occur instead of the after the fact detection, which is the only one possible by audit programs. For instance, it is possible to design a hardware protection mechanism to be triggered :-

(a) when writing into transient data is intended, but the actual memory address points to a semipermanent data area, a permanent data area or a program area.

(b) when authorised writing into a semipermanent data area is intended, but the actual address points to a permanent data area or a program area.

(c) when reading of data is intended, but the actual memory address indicates a program area with the Execute Only property.

(d) when execution of a program is intended, but the actual memory address indicates an area, which does not have an Execute property.

A number of different possibilities exist, whereby such a hardware protection mechanism may be realised. One possibility is the physical separation of areas into separately addressable memories. In this case the protection mechanism may siicnly utilize some of the address bits in combination with the required property as defined by the actual instruction (or a parameter thereof). Another possibility is the logical separation of the areas within the same memory by means of adjustable hardware registers, wherein the limits of each area may be defined. In this case the protection mechanism will decode the required property from the actual instruction (or a parameter) in order to define the set of limit registers to use, whereafter the actual address may be compared with the limit registers to ascertain that the address lies within the allowed limits. Still a third known method is the adding of control bits for each memory word in addition to the information bits, whereby the control bits indicate the actual property of the information to be stored within the memory word.

None of these methods give adequate protection, however, because all cross purpose memory accessing errors cannot be detected. If, for instance, writing of information to a transient data element is intended, but the address of another transient data element is actually indicated due to a cross purpose memory accessing error, then no triggering of the protection mechanism will occur. Similarly, authorised writing into semipermanent data with the actual address pointing within the semipermanent data area or within the transient data area will also go undetected, etc. As a consequence, the actual error which eventually triggers the hardware protection mechanism may be the first cross purpose memory accessing error, in which case the error localisation and correction is simple. More often than not, however, the actual error, which triggers the protection mechanism is only one of the secondary errors caused by some previous, undetected cross purpose memory accessing error. In this case the error localisation is extremely difficult, because the actual error may have been caused by a faultfree program operating with faulty data as has been described above. Also, in this case, the only practical error elimination scheme is a complete system restart to clear the system from all, as yet undetected but latent, cross purpose memory accessing errors. Of the three possible protection mechanisms mentioned above the third has the disadvantage, that it requires extra control bits for each memory word, and thereby requires more resources than the other methods, where the protection mechanism may be more centralized. It is mainly for this reason that the other methods have been preferred, i.e. separation of memory into disjoint areas with different properties. This has, in fact, been a contributing factor to the 'distributed* software realisation illustrated in Figure 6, where a single user is allocated multiple disjoint areas in the memory. Dispersing the software belonging to, or associated with, a single user over disjoint areas in memory as illustrated in Figures 6 and 7 (which is forced for reliability reasons if a logical or physical separation of memory areas as described above is used) reduces the manageability and maintainability of the software, because each piece of software must now be handled separately. For manageability as well as for maintainability reasons it would be advantageous if each user software unit could be handled as a single unit also when stored in memory. The method with extra control bits for each memory word attempts a partial solution to this problem. Nevertheless it will still not give an adequate cross purpose memory access protection. Figure 10 illustrates a simplified example of the utilization of this method for the implementation of the software associated with a single user.

The user software is shown to be implemented as a User Program Area and a User Data Area. The User Program Area contains a number of instructions, which together form the actual user program. The starting point of the User Program Area is given by the ESS pointer (Executable Segment Start). The User Data Area contains a number of data elements. These data elements have been named DEI to DE10 in the order they have been implemented within the actual memory words. The starting point of the User Data Area is given by the DSS pointer (Data Segment

Start). The actual data elements DEI - DE10 in Figure 10 may be regarded as an example of the implementation of the following logical data elements :-

0E1 HEADER Is read-only string (8) = "USER32XX", DE2 COUNTER 1 is integer 0 to 300, DE3 C0UNTER2 is integer -1000 to 1000, DE4 STATUS is array (0 to 4) of conditional-read-only WORD,

DE5: OUTLINK is link, DE6: TIMER is array (0 to 4) of integer 0 to 1.5, DE7: CATEGORY is array (0 to 4) of read-only set

(ON, OFF) = (ON, ON, OFF, OFF, ON*)

DE8: C0UNTER3 is conditional-read-only integer 0 to 9,

DE9: NUMBERING is integer 0 to 10000, DE10: CHECKSUM is read-only integer 0 to 10000,

where HEADER, COUNTERl, etc. are the actual functional names of these data elements as used in the program. Each memory word in Figure 10 contains a set of information bits and a set of control bits. The control bits are assumed to indicate the property (EO, ER, RW, RO, CRO) associated with the information stored in the information bits of the memory word. Hence all the memory words used to store instructions of the program are defined to be EO words (or ER where appropriate). The data words DEI - DE10 are defined as R0, CRO or RW words, depending on how the associated information is defined. The control bits may of course be used for purposes other than property indication, e.g. redundancy checks (not relevant for the present purpose).

As illustrated by Figure 10 it is possible to locate data elements with the same properties within the same memory word, provided that a sufficient number of information bits are available to accomodate all information elements within one word. It is not possible to mix data elements with different properties within the same memory word, even when there are unused information bits available. Hence a certain amount of unused information bits is always implied.

Accessing of the memory in Figure 10 is done by the well known Base Address + Offset technique. Thus the base address of the User Program Area is given by the ESS pointer and the actual instruction undergoing execution by a relative Program OFFset (POFF). Similarly, the base address of the User Data Area is given by the DSS pointer and the actual accessed data element by a relative Data OFFset (DOFF) given as an operand within the data accessing instructions. This technique is even directly supported by current microprocessors like the MC68000, the Z-8000 and the 8086, where base or segment registers are utilised for the base addresses with the offsets specified separately and independently of the base addresses.

Although a certain amount of hardware support is already available, this does still not solve the cross purpose memory accessing problem because :-

(a) The base addresses in the base/segment registers are still calculated by the programmers and are therefore subject to programming errors.

(b) The offsets themselves may be directly given in the instructions, but may also be indirectly calculated by the programmer. In the latter case the offsets are also subject to programming errors.

(c) Utilisation of adequate software range checks is generally avoided because of their accompanying unacceptable performance degradation.

The calculation of the base addresses is a relatively straightforward matter, because these refer to specific and unambiguously defined points in the memory of a system. Figure 11 illustrates the well known technique of a general System Descriptor Table (SDT), where each user is assigned an entry in this table. Such a Descriptor Table is for instance forming the central Address Calculation Unit described in the Swedish patent 365093. Each entry is assumed to contain four items of information for the purpose of base address calculation. These four items are :- ESS The Executable Segment Start Address ESSZ The Executable Segment Size DSS The Data Segment Start Address DSSZ The Data Segment Size

Use of a System Descriptor Table of the kind illustrated in Figure 11 gives a number of advantages. Calculation of the base address for a program or a data area for a particular user is a matter of a simple readout of the appropriate information from the table entry associated with that user. Secondly, the offset value for any instruction or data element may simply be checked against the specified segment size in order to indicate overflow. Thirdly, it is possible to perform the base address calculation and range check of any offset automatically by integrating it in the hardware or the firmware of the system, thereby making it impossible for the programmers to fiddle with these address calculations. Fourthly, it is possible to make all user areas completely relocatable, even under on-line conditions, provided that no user programmable pointer relationships are used anywhere within the system. Fiftly, it is possible to assign the actual table entry associated with a particular user software unit dynamically when that software unit is loaded into the system, thereby providing a basis for pluggability of the software units. Finally, it is also possible to separate the Program Areas, the Data Areas and, in fact, the System Descriptor Table Area itself from each other by means of physically disjoint memories in order to enhance the performance of a system by the resulting ability to access the memories in parallel. The processing system of the Telecommunication System AXE designed by L.M. Ericsson in Sweden is a typical example of a system utilising the above mentioned method in order to obtain the advantages mentioned. A number of problems still exist, however, particularly in connection with the calculation of the offsets for the different data elements associated with a particular user. Unique data elements, i.e. data elements which occur only once, do not normally cause any problem, because their offset values may be hardcoded as operands into the instructions relative to the actual base address, provided that the hardware operates on the base address 4- offset principle. This is assumed to be the case with the data elements HEADER, C0UNTER1 and C0UNTER2 (corresponding with DEI, DE2 and DE3 in Figure 10), where HEADER (DEI) is implemented as the first word relative to the base address DSS (i.e. word offset = 0), COUNTERl is implemented as the least significant part of the second word relative to the base address DSS (i.e. word offset * 1 with bit offset within the word = 0 and a specified number of bits to be accessed) and C0UNTER2 is implemented as the most significant part of the second word relative to the base address DSS (i.e. word offset = 1 with a specified bit offset within the word > 0 and a specified number of bits to be accessed). Because these offsets are fixed offsets and do not change with time they may easily be hardcoded into the instructions, t either as direct accesses (in the case of word accesses or when the hardware supports different access formats) or as masked accesses (for part-of-word accesses in systems where only word accesses are directly supported). Accessing of the data element STATUS, which corresponds with the DE4 ,array in Figure 10 is more complex. First of all it is normally not the entire array that is accessed but only a single element of the array. Thus it will be a single element DE4(X) which will be accessed, where X is defined as the index of the actual element. According to the definition the index may vary within the range 0 - 4. The actual address of any accessed element is in this case composed of the following three elements :-

(a) The Base Address of the Data Area itself (DSS).

(b) The Offset to the first element of the array (i.e. the offset to the memory word containing DE4(0) - 2). (c) The Index Displacement of the actual element of the array, calculated as the actual Index times the Length of a single array element, where this length is to be taken as the number of bits reserved for a single array element.

In Figure 10 the DE4 array occupies five words in the memory with each array element utilising an entire memory word. The actual data offset for STATUS (2) occupying DE4 (2) is now calculated as :-

DOFF =2 [Offset to DE4(0)] + 2 [Actual index] * 1 [Length of array element]

The Length of each array element is a fixed value and can therefore be hardcoded into the instructions of the accessing program. However, because the index value is variable, the address calculation must be explicitly performed by the programmers themselves and will therefore also be subject to programming errors. In order to guard against such errors an index range check is always warranted to ensure that the used index at all times remains within its legal range (0 to 4 for DE4 in Figure 10). Often this index range check is omitted because it will significantly degrade the performance of the system, thereby again making cross purpose memory protection errors possible. When the length of an array element is less than a memory word as illustrated by the data elements CATEGORY and C0UNTER3, which are implemented as DE6 and DE7 in Figure 10, then certain new problems arise in the actual memory accessing. The simplest solution is, of course, to reserve an entire memory word for each array element regardless of the memory element actually utilises the memory word or not. Because of hardware limitations no single part-of-word element should actually cross a physical word boundary in the memory. Thus, whenever a particular array element requires more than half of the available bits of a memory word, then an entire memory word must be reserved for each array element. However, when a particular array element requires less than half of the available bits in a memory word while, at the same time, the number of elements in the array becomes large and the number of bits reguired per array elements is small, then^' reserving an entire word for each array element leads to a considerable waste of memory space, which in some cases will be completely unacceptable. The solution for such cases is to pack more than one array element in the same word. The number of bits actually reserved for each array element must be an integer fraction of the number of bits in an entire memory word in order to ensure that no array element will cross a physical word boundary. As an example, in a system with 24 bit memory words, array elements of 1, 2, 3, 4, 6, 8, and 12 bits would be possible. Hence, if a logical data element would require 7 bits, then an 8 bit array element would actually be used. As long as the number of elements in an array is fixed, the accessing of any element in the array does not pose any great problems, provided that adequate range checking is performed at all times. However, the number of elements in arrays do vary. Normally the number of elements is increasing with time as the systems expand in order to be able to cope with new requirements. Any associated, arrays have thereby to be correspondingly extended. The effect of this expansion can be devastating. The data element DE5 in Figure 10 occupies words 8-10 in the User Data Area, i.e. the word offset to this data element, which is hardcoded as an operand into the instructions of the program, is 7. If now the DE4 array is extended by say 3 more array elements, then the entire DE4 array would thereafter consist of 8 elements, i.e. DE4(0), DE4(1), DE4(2), DE4(3), DE4(4), DE4(5), DE4(6) and DE4(7). For pure address calculation reasons the new array elements have to be appended to the previous array elements, i.e. they have to occupy memory words 8, 9 and 10. However, these memory words were previously occupied by DE5. In other words, extension of an array may cause other data element to be relocated. In our example DE5 would now be relocated 3 words forward, thereby necessitating a change of the hardcoded memory offsets within the program. This change will of course ripple through all subsequent data elements. This is especially dangerous if a number of disjoint programs access the same data areas, because it will be very difficult to verify that all data accesses have actually been changed. Thus the extension procedures may again form a potential cause of cross purpose memory protection errors. This problem is further complicated when multidimensional arrays are used, i.e. arrays where the element of the arrays in themselves are arrays.

One partial solution to the above problem is the way utilised within the previously mentioned AXE system, which is described in Ericsson Review No. 2 1976, and also described in the Swedish patent 365 093.

This system recognizes that any user function may be implemented in software in the standardized way shown in Figure 12, where a user function comprises a Program part, a Common Data part and an Individual l5ata part. The Program part of Figure 12 corresponds with the User Program Area in Figure 10.

The Common Data part may be considered to contain all unique (nonreplicated) data elements in Figure 10, i.e. DEI, DE2, DE3, DE5, DE8, DE9 and DE10.

The Individual Data part consists of an array with n elements in Figure 12. Hence the data elements DE4, DE6 and DE7 in Figure 10 may be considered to belong to the Individual Data part with n = 5. Figure 13 shows the actual implementation principles of the system. For performance reasons the memory of the system is separated into three physical memories, the Program store (PS) containing all programs, the Data store (DS) containing all user data and the Reference store (RS) containing all System Descriptor Tables. The Reference Table in Figure 13 corresponds directly with the System Descriptor Table in Figure 11. Each user function is defined as a Block. The Central Processing Unit directly supports the structure with a dedicated Block Number Register holding the identity of the currently active block. The contents of the Block

Number Register is used to identify the actual Reference Table Entry. The three most important elements of a Reference Table Entry are shown in Figure 13. These are

PSA The Program Start Address. This corresponds directly with ESS in Figures 10 and 11. BSA The Base Start Address. This corresponds indirectly with DSS of Figures 10 and 11 in the manner explained below.

BS Block State. Administrative information.

Each Reference Table Entry also contains a auxiliary information elements like the ESSZ and DSSZ elements in Figure 11. These elements are not shown in Figure 13.

The Program shown in Figure 13 corresponds directly with the User Program Area of Figures 10 and 11 (disregarding the Signal Distribution Table at the beginning of the Program).

The implementation of the Data Area differs from the principle shown in Figure 10 and Figure 11. Instead of assembling all data elements belonging to a single user into a single User Data area in the manner shown by Figures 10 and 11 each individual data element is separately and individually assigned a memory location in the Data Store (DS). In order to allow an easy address calculation to each single element a Data Descriptor (called a Base Address in Figure 13) is associated with each single data element, regardless of whether the data element is a single element or an array element. All Base Addresses for data elements belonging to a particular block are assembled into the Function Block Base Address Table for that particular block. The start address to this table is given by the BSA address in the reference table entry corresponding with the block. Each base address contains all the relevant information associated with the corresponding data element, i.e. :-

* The absolute address where the data element is located (or the start address of the first element of an array). * The length of the data element in number of bits.

* Indication whether the data element is an array element or not

* The number of array elements if te data element is an array.

* Access rights to data element (e.g. RW, RO). * Auxiliary information not directly relevant for the described purpose and therefore not further itemized.

The described base address table principle has a number of advantages. Specifying all the information relevant for the calculation of an address as part of the base address makes programming simple, because the programmer will not have to perform any explicit address calculation at all.. The only information required to access a particular data element is the offset to the base address associated with that data element. It is to be noted that the accessing of array elements by means of a simple offset is only possible when it is indicated within the base address itself that an element is an array element and when, furthermore, the index to the actual array element to be accessed is given by a predefined special purpose process register within the CPU. In Figure 13 this special purpose process register is denoted as the Pointer Register and is used to identify one instance of the Individual Data shown in Figure 12. By designing the CPU so that the actual offset is always given directly as an operand within the machine instructions (corresponding with the OP1 or OP2 parts of a machine instruction in Figure 3) it is possible to simplify the programming considerably. Any unique data element within either the Common Data or within one instance of the Individual Data may now be directly accessed by means of its fixed, hardcoded offset. value. Provided that the index to the actual instance of the Individual Data and the base address itself are checked, then cross purpose memory accessing errors can be completely eliminated as far as these unique data elements are concerned.

Unfortunately both single- and multidimensional arrays may still exist within both Common and Individual Data. For these array elements the addressing still has to be explicitly specified with associated explicit address checks. This case is still subject to the previously mentioned drawbacks with the associated possibility for cross purpose memory accessing errors still in existence. One of the big advantages of a system designed according to the principles illustrated in Figure 12 as compared to a conventional system designed according to the principles of Figure 5 is that the data elements belonging to a particular user is only accessed from the program part belonging to that same user. This is the reason why each particular user may have^" its own unique base address table (» the Function Block Base Address Table in Figure 13), which is only accessible by the program part associated with that particular user. This considerably simplifies the maintainability, manageability and enhancability of the sof-cware, because every user function may now be handled as a single entity. It is still not possible to handle any part of the user functions (i.e. program part, common data part and individual data part) separately because these are logically tied into each other. Secondly, the reliability is also directly enhanced, because it is now possible to introduce a hardware protection against a particular user accessing the base address table belonging to a different user, thereby preventing all accesses of data elements belonging to a particular user by other-users before that access can take place. If no multidimensional array elements exist it is even possible to extend this hardware supported protection to the level of a single data element in Figure 13 (i.e. Cl, C2, X, Y). There is now no need for separate access right protection associated with a particular memory word (by means of extra control bits in addition to the information bits) or associated with a particular memory area (by means of limit specifying register or similar) as previously described. This is the reason why the access right indication may.be part of the base address itself. An arrangement according to Figure 13 requires the supporting processors to be specially designed in order to achieve efficient implementation. This arrangement cannot therefore be efficiently supported by presently available microprocessors, because these operate on, and efficiently support, the general base address + explicitly indicated offset principle illustrated in Figure 10. On the other hand, a specially designed processor cannot efficiently support an implementation according to Figure 10. In neither case are multidimensional arrays efficiently and reliably supported, because they must always be explicitly programmed.

With an arrangement according to the invention the above described disadvantages can be completely eliminated while at the same time being able to use one of the commersially available microprocessors. DESCRIPTION

The basic principle of the invention will be described with the aid of Figures 14 - 22.

Figure 14 shows the general principle of the invention. A Master Control Unit (MCU) according to the invention is interposed between the Main Memory (M) and the CPU, which in themselves may be of the type described in Figure 1, whereby the Address and Data Buses (ABUS and DBUS) from the CPU are connected to the MCU, which via secondary Address and Data Buses (ABUS2 and DBUS2) is connected to the Main Memory (M). The control signals for reading and writing from the CPU are connected to the MCU. The MCU issues its own secondary read and write signals (R2 and W2) when actually reading and writing in the Main Memory. The MCU may also initiate feedback to to CPU via an interrupt line of known design.

Figure 15 shows a possible arrangement of the MCU according to the invention. The MCU contains an internal memory for a Data Descriptor Table (DT), a set of internal index registers (XRO - XRQ), three arithmetic circuits (AC1 - AC3), a mode decoder (MD), an index register decoder (XDEC), a mask and shift unit (MSU) and a range check and conversion unit (RCU).

The virtual address issued by the CPU on the Address Bus (ABUS) consists of two parts according to the invention. The first part is used to indicate one of the possible entries in ^"the Data Descriptor Table (D ) required for translation of virtual addresses issued by the CPU on the Address Bus (ABUS) into Real Addresses issued by the MCU to the Main Memory M on the secondary Address Bus (ABUS2). The Data Descriptor Table contains at least one entry for every addressable data element or structure in the main memory M, whereby the actual entry is indicated by means of an address decoder (ADECl). Each entry is shown to contain 5 parts in Figure 15, namely the XRC, BA, SZ, LL and NOV parts.

The XRC part of a Data Descriptor Table entry contains a Code which via the decoder (XDEC) is used to indicate whether one of the index registers are to be used in the address translation in the manner that will be further described below. Depending on the actual XRC code value the BA part of the same table entry will either contain the Base Address of a data element or structure in the main memory or indicate a secondary Data Descriptor Table entry. The SZ part contains the actual allocated SiZe of any element to be manipulated by the logic of the MCU.

The LL and NOV parts of a Data Descriptor Table entry is intended to be used for range checking and conversion purposes, which range checking and conversion may optionally be integrated in the MCU by means of the range check and conversion unit RCU. The principle of this range checking and conversion is subject of a separate patent application and described in the U.K patent application No. 8334079.

The second part of the virtual address issued on ABUS by the CPU contains a mode indicator. This mode indicator, which is decoded by means of the mode decoder (MD), makes it possible to modify the logic performed by the MCU at the same time as it is performing an address translation. Examples of possible types of modification are :-

* Postincrement of any indicated index register, i.e. after it has been used in an address translation.

* Preincrement of any indicated index register, i.e. before it is used in an address translation. * Postdecrement of any indicated index register, i.e. after it has been used in an address translation.

* Predecrement of any indicated index register, i.e. before it is used in an address translation.

The general types of such modifications are of course not restricted to the types given in the examples above. Figure 16 illustrates the main principle of Virtual to Real Address translation by the MCU. This address translation principle is valid for both reading and writing of information from and to the main memory (M). The address translation cycle therefore starts when the CPU issues a Virtual Address on its Address Bus (ABUS) and asserts the R (Read) or W (Write) control signal to the MCU (not shown in Figure 16). The address translation is performed in a number of consecutive phases indicated by means of discrete signals _lf T₂, T₃, etc. issued by control circuitry of known design, for instance a microprogrammed control unit and enabling the control gates in Figure 16. Wherever required, internal latching of the informtion is assumed to exist without this being explicitly indicated to avoid .

Such latching is standard in logic circuitry and does not add to or detract from the principle of the invention as such. In phase the two parts of the Virtual

Address issued by the CPU on the Address Bus (ABUS) are via two control gates (G1A and GIB) asserted and latched at the inputs of the virtual address decoder (VAD) of the

Data Descriptor Table (DT) and the mode decoder (MD) respectively. Simultaneously the intermediate index register XR, which forms a part of the arithmetic circuit AC2 is reset to zero via a control gate (G1C) in order to prepare for any subsequent address translation. In phase T₂ the XRC code of the table entry enabled by the virtual address decoder VAD is asserted and latched at the input of the index register decoder XDEC, whereby one of the outputs X', XO, XI, ... XQ will be enabled.

Provided that one of the output signals indicating the use of an index register (XO, XI, ... XQ) is asserted by the index register decoder (XDEC) then the contents of this index register will in phase T₃ by means of one of the gates G30 - G3Q and a circuit multiplier within the arithmetic circuit AC2 be multiplied by the SZ part of the table entry still being indicated by the virtual address decoder VAD. The result of the multiplication will thereafter be added to the contents of the intermediate index register ΣXR. The result of this addition will then in phase T₄ via the gate G4 replace the previous contents of the intermediate index register IXR. If no index register is indicated (i.e. the signal X* asserted by the index register decoder XDEC), then none of the registers G30 - G3Q and G4 will be enabled. In this case phases T₃ and τ₄ could, in fact, be completely bypassed. Such bypassing is again a standard technique and not as such relevant for the invention.

In phase 5 the BA part of the table entry indicated by VAD is transferred to the arithmetic circuit (AC1). If the corresponding XRC code does not indicate use of an index register, then BA contains .the Base

Address of a data element or structure in the Main Memory (M). In this case the index register decoder (XDEC) still asserts the signal X* . Hence the control gate (G5B) will be enabled, i.e. the base address is added to the current contents of the intermediate index register (IXR) of the arithmetic circuit (AC2) and the result issued by the MCU on the secondary address bus (ABUS2) to the Main Memory (M). In this case one of the control gates (G6R or G6W) of the mask and shift unit (MSU) will be enabled in phase T₆. Principally, if the CPU originally issued.a Read (R) signal to the MCU, then the MSU will issue a secondary read signal (R2) to the Main Memory (M), otherwise a secondary write signal (W2) will be issued. The address translation is thereby complete. When an index register is indicated, then the BA part of a table entry will not indicate a real base address but instead contain a secondary virtual address. This secondary virtual address will now via the control gate (G5A) be asserted and latched on the input of the virtual address decoder (VAD), thereby replacing the previously latched virtual address. As. a result a new table entry will be indicated. Phase T₆ will now, instead of terminating the address translation, start a new cycle, where T₆ corresponds with T₂, ₇ with T₃, etc. In Figure 16 this is indicated by T_2+4j, ^τ ₃+4i' ^e-cC« An arbitrary number of index registers may thus participate in any address translation. Figure 16 also illustrates a possible arrangement for postincrementing and -decrementing of an index register as part of the address translation by means of the arithmetic circuit (AC3). This arithmetic circuit contains an internal memory (IM), which is shown to contain at least two memory words, the contents of which are fixed to the values +1 and -1. The appropriate word to be used is indicated by the corresponding outled from the mode decoder (MD). In phase T^^ , i.e. after the value of a particular index register has been used by the arithmetic circuit (AC2), the contents of any particular index register is.gated onto the adding circuit of AC3 via one of the control gates (G4A0 - G4AQ), provided that this particular index register is indicated by one of the output signals from XDEC (XO, XI, ... XQ) and that the same index register is indicated by one of the output signals Y from the mode decoder MD (YO, Yl, ... YQ). In phase T₅₊₄j the result of the addition is gated back to the same index register by means of one of the control gates (G4B0 - G4BQ). Depending on which word in the internal memory (IM) which is indicated, the index register will be incremented or decremented.

If the arithmetic circuit (AC3) had been designed to operate in phases T_1+4j and T₂₊₄-s instead of phases T₄₊₄.= and _s+4-5, then the resulting operation would preincrement or predecrement the index register. Figures 15 and 16 show one possible arrangement to implement the basic principles of the invention. A number of variations of the gating and decoding arrangements are of course possible. One example is the arithmetic circuit (AC3), where the increment and decrement effects may be achieved without the use of an internal memory etc. Another example is the possibility of bypassing phases T₃ and τ₄ entirely in the case where no index register register is used. A third example is to use a NOR gate with signal XO, XI, etc as input to generate the signal X' when none of the inputs are asserted. Once the basic principle of the invention is known, such variations become obvious and are therefore not further discussed or described.

All information transfer to and from the Main Memory (M) is performed on a word basis, i.e. information is transferred over the secondary data bus (D3US2) one word at a time. Whenever the actual logical data element accessed is implemented as a full word, the information may be transferred from DBUS2 to DBUS and vice versa without any modification being required (disregarding possible modifications by the range check and conversion unit RCU).

Utilising one word of storage space for every data element is not an efficient way to use the available memory space, however, because many data elements do not require a full word. The logical data type Boolean with its two possible values true and false may, for instance, be implemented as a single bit. In order to avoid wasting memory space several logical data elements may be 'packed' into a single word. Readout of information from, and writing of information into, a logical data element, which has been implemented as part of a memory word where the remaining part of the memory word is utilised for other logical data elements will now require a certain amount of processing if it is required that the actual information transferred to and from the CPU on the data bus (DBUS) is to be normalised into a right adjusted form. This processing is performed by means of the mask and shift unit (MSU) in Figure 15.

The detailed logic of such a mask and shift unit is in itself known and utilised in computing systems and is therefore not in itself a subject of the invention. The way the MSU is controlled is, however, essential for the invention as a whole. Figure 17 therefore shows a possible logic arrangement of such a mask and shift unit and how this logic interworks with the other parts of the MCU. All logic circuits of the MSU are enabled by the

X* signal asserted by the XDEC, i.e. the MSU will only operate when the Main Memory is to be accessed from the MCU. The MSU in Figure 17 is shown to consist of 6 control gates (GWDA,_>GWDB, G6RA, GR6B, G6WA, G6WB), two rotate units (RRU and RLU), a mask unit (Mϋ) with associated mask decoder (MDEC) and a logic addition unit (ORU).

Whe the MCU has completed the virtual to real address translation as described above, and asserted the real memory address on the secondary address bus (ABUS2), then the virtual address decoder (VAD) in Figure 15 still identifies a particular entry in the Data Descriptor Table (DT). In particular the SZ part of this entry is of importance for the mask and shift unit MSU. The SZ part determines the allocated size for the actual data element in the Main Memory, i.e. the number of bits to participate in any data transfer and is asserted as the input to the mask decoder (MDEC) in Figure 17.

The mask decoder (MDEC) issues a mask bit pattern to the mask unit (MU). This mask bit pattern comprises an entire word as follows: 1 bit data element: 000 0000001

2 bit data element: 000 0000011

3 bit data element: 000 0000111

word data element: 111 1111111

In addition the mask decoder also issues a signal (WZ) when the actual data element occupies an entire word in the Main Memory (M), which signal is used as input to the internal control logic in the MSU. The real address issued by the arithmetic circuit

(AC1) actually identifies the least significant bit of the data element to be accessed. All Main Memory accesses are word accesses, however. The real address output from AC1 is therefore split into two parts as indicated in Figure 15, the first part forming the address to a memory word within the Main Memory and the. second part forming the bit address of the least significant bit of the actual data element within that word. The word address is issued on the secondary address bus (ABUS2). The bit address is used to control the operation of the rotate units (RRU and RLU) within the MSU. If the wordlength of the Main Memory is a power of two, then the bit address may be directly obtained by means of the binary arithmetic within the arithmetic circuits (AC1 and AC2). For any other wordlength extra circuitry of in itself known design will be required to accomodate the nonbinary nature of the resulting bit address calculations. In the following examples it will be assumed that the word length of the Main Memory (M) is 16 bit, whereby the bit address within a word will require log₂ (16) = 4 bits.

If a data element occupying an entire memory word is to be read from the Main Memory, then the SZ part of the DT entry will indicate 16 bits to participate (= the above assumed word length). The actual mask value generated by MDEC will now be 1111111111111111 while at the same the a valid WZ signal is issued. Because an entire word transfer is indicated, the bit address to the least significant bit of that word will, of necessity, be 0. According to Figure 16, the actual word address is issued on the secondary address bus (ABUS) at phase ^τ5+_4j ^an<* ^{"tιe actυa}l secondary read signal (R2) at phase T_g+4.= by means of the control gate G6R, which in Figure 17 is represented by the control gate G6RA. At phase T₇₊₄-t both the RRU and the MU will be enabled. The rotate unit (RRU) will pass the information from the secondary data bus (DBUS2) directly to the mask unit (MU) without any rotation, because the least significant bit address obtained from the arithmetic circuit (AC1) is 0. The mask unit will, in its turn, also pass the information straight on to the RCU, because the actual mask word is 1111111111111111 and the MU is read enabled (R). The principal information transfer is therefore as illustrated by Figure 18a.

If instead information is to be written into a data element occupying an entire memory word, then the information to be written into the memory is obtained from the data bus (DBUS) via RCU at the latest at phase ^τ5+4i' i_' ^e* ^{ai: tne s me} time as the real address is issued on the secondary address bus by the MCU. As Figure 17 shows the information is gated directly to the secondary data bus (DBUS2) by means of the control gate (GWDA). The secondary write signal (W2) is in this case issued at phase T₆ by means of the control gate (G6WA). The principal information transfer in this case also follows the principle in Figure 18.

If we now assume that the actual data element to be read is a 4 bit data element, which occupies bit position 7-4 in a memory word, then the actual bit address from AC1 will be 4 (= actual least significant bit). The corresponding mask word obtained from MDEC will in this this case be 0000000000001111. The principle of information transfer is in this case illustrated by Figure 18b. After the secondary read signal (R2) has been asserted by means of the control gate (G6RA) the RRU and MU will, similar to the reading of an entire word, be enabled in phase T_7+4j. However, because the bit address asserted at the input of the rotate unit RRU is 4, the information word obtained from the secondary data bus (DBUD2) will now be rotated four steps to the right. MU will in this case only pass the four least significant bits of the memory word to the primary data bus (DBUS) because of the mask value 0000000000001111. Hence the information passed to the primary data bus will always be right adjusted with leading zeroes as illustrated by Figure 18b.

Finally, Figure 18c illustrates the principle of writing into a data element in the Main Memory when the data element occupies less than a memory word. Because the memory operates on a word basis, the entire memory word must, in this case, first be read out, the actual portion of the memory word allocated to the actual data element replaced by the new value of the data element and the entire meory word finally written back into memory. Hence, with reference to Figure 17, in phase T_6+4j the address is asserted on the secondary address bus (ABUS2). At this AC1 asserts the bit address to the least significant bit of the actual data element within the memory word (which data element is still assumed to occupy bit positions 7-4) i.e. the bit address controlling-the rorate units is 4. Because the data element is a four bit data element the mask word issued by MDEC will again be OOOOOOOOOOOOllll. In phase T_6+4j the data to be written will already be available on the input from the primary data bus (DBUS) from the CPU (via the RCU) in right adjusted format with leading zeroes. As shown by Figure 17, a secondary read signal (R2) is now issued by the MSU by means of the control gate G6RB, because the WZ signal from MDEC is not asserted for any less than word length operation. In phase T₇₊₄ all of the units RRU, MU, ORU and RLU are enabled, RRU, RLU and ORU due to WZ not being present and MU due to the presence of the W- signal from the CPU. Hence the RRU rotates the information obtained from the Main Memory the number of steps indicated by the actual bit address from AC1 to the right (in this example 4 steps) in order to right adjust the information. The mask unit (MU) is in this case write enabled, which causes the mask word (0000000000001111) to be inverted (1111111111110000) before it is used, thereby clearing the portion of the information associated with the actual data element. The resulting information is now merged with the information from the RCU in the ORU, principally by means of a logical 'OR' operation. Finally the rotate unit (RLU) rotates the information output from ORU the number of steps given by the bit address in AC1 to the left. The output from the RLU may now, in phase ₈₊₄^, be issued back to the Main Memory on the secondary data bus (DBUS2) by means of the control gate (GWDB) and finally, in phase T_9+4j, the secondary write signal (W2) is issued by means of the control gate (G6WB).

In order to be able to perform the address translation it must be possible to transfer information from the CPU directly to the index registers of the MCU and vice versa. The mode decoder (MD) in Figure 15 has an output signal (XR) for this particular purposes. When the XR signal is asserted the normal address translation by means of the arithmetic circuits (AC1 and AC2) is inhibitied. The XR signal instead enables the index register indicated by the corresponding output code from ^• the XDEC decoder as the origin or destination of the information transfer to or from the CPU, depending of whether the CPU has asserted as read (R) signal or a write (W) signal.

The application of the invention will now be illustrated by means of a detailed example. This example consists of a logical data structure, which is specified by the following high level programming language statements :-

P is integer 0 to 59, Q is array (1 to 3) of structure where A is integer 0 to 1000,

B is integer 0 to 100, C is integer 100 to 200, D is array (-3 to -1 ) of integer 1 to 12,

E is array (1 to 24) of array (3 to 5) of integer 0 to 1,

F is integer -500000 to 500000; , R is array (1 to 3) of integer 0 to 100,

The above data structure contains a number of data elements, each one with a given legal value range. The legal values for the data element P are for instance only the integer values 0, 1, 2, .... 58, 59. Similarly, for arrays of data elements, the legal values of the corresponding indices are explicitly specified. Thus legal instances of the data element D are D(-3), D(-2) and D(-l). Figure 19 illustrates a possible way of allocating memory space to the above mentioned data elements. A total of 36 memory words are utilised at the Main Memory addresses X+o, X+l, ... X+35. The first memory word at address X+0 is used to hold the memory element P. The memory words at addresses X+l to x+33 are allocated to the Q array with the first 11 words (X+l to X+ll) being allocated to the first Q-array element (Q(l)), the next eleven words (X+12 to X+22) to the second Q-array element (Q(2)) and the last eleven words (X23 to X33) allocated to the third and last Q-array element (Q(3)).

Within each Q-array element the first word (X+l for Q(l), X+12 for Q(2) and X+23 for Q(3)) is allocated to the element A of the corresponding structure. The least significant 8 bits of the second word are allocated to the element B and the 8 most significant bits of the same structure to element C. The third word is allocated to the D array with the first element of the D-array (D(-3)) occupying the 4 least significant bits, the next element of the D-array (D(-2)) occupying the next four bits etc. The E-array occupies the next 6 words. Finally the F-element of the structure occupies the two last words of each Q-array element.

The R array finally is allocated to the two last words (X+34 and X+35, each element of the array occupying 8 bits. Figure 20 shows an example of a Data Descriptor

Table, which allows the data structure as implemented in Figure 19 to be accessed. The data element P is allocated the single entry 0 in the table. For P no index register is indicated (XRC = - ). The Base Address (BA) is specified as X+0 with the bit address of the least significant bit being 0. The number of bits allocated to the data element (SZ) is specified as 8, i.e. the 8 leftmost bits of the memory word are not used as indicated in Figure 19. The lowest legal value of the data element (LL) is specified as 0 and the total number of legal values (NOV) as 60. When the data element P is to be accessed the CPU now only has to issue the virtual address 0. As previously described with reference to Figures 16-18 the MCU will then assert the corresponding real address (X+0) to the Main Memory with the MSU performing any required masking in and out of nonrelevant bits.

Data element A, which is replicated as part of each of the elements of the Q array is allocated two table entries (1 and 2), with table entry 1 corresponding to the virtual address being issued by the CPU when accessing A. Table entry 1 indicates the use of the XRO index register (XRC + XRO). The size of the associated element is given as 176 bits (SZ * 176). The LL and NOV entries now indicate the lower limit of the legal index value (LL - 1) and the number of elements in the array (NOV = 3). Because an index register is indicated the base address element now contains a secondary virtual address (BA - 2), pointing to the secondary table entry of the element A. This secondary table entry now holds the start address of the element (BA = X+l) with bit address - 0. The size of the accessed element is given as 16 and the limit values as 0 and 1001. Provided that a legal index value is held in the index register XRO when the CPU issues the virtual address 1 then the real address which will be issued by the CPU will be either X+l, X+12 or X+23 with the actual transfers to be performed on a word basis.

In a similar manner to element A, element B occupies table entries 3 and 4, element C entries 5 and 6, element D (which is a two-dimensional array) enties 7-9, element E (a three-dimensional array) entries 10-13, element F entries 14 and 15 and element R entries 16 and 17, the actual virtual addresses being 3 for B, 5 for C, 7 for D, 10 for E, 14 for F and 16 for G.

Figure 21 illustrates an alternative way of allocating memory space to the data element P, the structure Q and the array R. The allocation in Figure 21 i logically equivalent with the allocation in Figure 19. Figure 22 shows a corresponding example of an associated Data Descriptor Table. By comparing Figure 22 with Figure 20 it can be seen that the virtual addresses associated with each data element do not change. A Master Control Unit (MCU) according to the invention thus makes it possible to completely separate the physical layout of the data structures allocated in the memories from their logical function.

An MCU according to the invention may function without a range check and conversion unit (RCU). This simply means that the RCU shown in Figure 15 will be shortcircuited, i.e. the data bus from the CPU (DBUS) is to be directly connected to the MSU and the index registers of the MCU (XRO - XRQ). The LL and NOV entries in the Data Descriptor Table will then, of course have no function at all. Operating the MCU wihout an RCU sets certain restrictions, however. The function of the RCU is to ensure that all values transferred to and from the CPU are within their legal value ranges as seen from the CPU, while at the same time store these values in their most efficient form in the memory. An RCU, which is able to perform these functions is described in the U.K. patent application No. 8334079.

The memory allocation examples shown in Figures 19 and 21 in fact postulate the existence of such an RCU as will be explained below. The data element D forms an array with three elements inside each element of the structure Q. Each individual D element may thereby take any of the values 1-12 according to the logical specification of the element. Each D element is furthermore identified by an index with the logical value -3, -2 or -1. The logical values of the index to a Q element are correspondingly 1, 2 or 3. The CPU always operates with these logical values. However, when Figures 19 and 21 are examined in combination with the described logic of the MCU, it can be seen that the MCU needs to operate on normalised index basis, where the first element is associated with index value 0, the second element with index value 1, etc. Hence, a logical to physical index translation is necessary to translate the logical Q-indices 1-3 into their normalised 0-2 counterparts as well as the logical

D-indices -3 1 into their normalised 0-2 counterparts.

Without the RCU there are basically three options available :-

(a) Programming both the translation and necessary range checks explicitly.

(b) Enable the logical indices to be directly used by allocating space for all nonused index values in the arrays.

(c) Restrict the programmers to use only normalised index values in their programming.

None of the above options manages to completely eliminate the previously mentioned cross purpose memory accessing errors. However, with an MCU as described above and a range check and conversion unit (RCU) as described in the above mentioned patent application cross purpose memory accessing errors may be completely eliminated, thus considerably enhancing the security of the associated systems.

Assume our previously specified logical data structure :-

P is integer 0 to 59, Q is array (1 to 3) of structure where A is integer 0 to 1000, B is integer 0 to 100, C is integer 1 0 to 200,

D is array (-3 to -1 ) of integer 1 to 12, E is array (1 to 24) of array (3 to 5) of integer 0 to 1,

F is integer -500000 to 500000; ,

R is array (1 to 3) of integer 0 to 100,

which structure may be implemented in a 16 bit memory as illustrated in Figures 19 and 21.

Let us further assume that the following logical operation is to be performed on the data elements of this data structure :-

R(2) := Q(2).B

or, in other words, the value held in element B of the second instance of structure Q is to be transferred to the second instance of element R. With reference to

Figure 19 the 8 least significant bits of the memory word at address X+13 have to be read and the contents transferred to the 8 most significant bits of the memory word at address X+34. In the implementation according to Figure 21 the contents of the 8 most significant bits of the memory word at address X+4 are to be transferred to the 8 most significant bits of the memory word at address X+34.

With an MCU according to the invention this operation may now be performed by executing the following machine instructions in the CPU, assuming the same kind of CPU as described in the introduction :- SO 2, βAR+{MOD=XR, OFFSET=3)

SO 2, SAR+{MOD=XR, 0FF3ET=16) SD DR, €AR+(MOD=none, OFFSET=16)

The first SD instruction issues a virtual address on the address bus (ABUS) in Figure 14. This virtual address consists of the mode indicator and the Data Descriptor Table entry identity. The mode indicator indicates and index register, i.e. the mode decoder (MD) in Figure 15 will now issue an XR signal as has been previously described. The virtual address decoder will now identify the entry in the Data Descriptor Table specified by the Offset part of the virtual address, i.e. table entry 3. Table entry 3 indicates index register XRO in its XRC field. Because the XR signal is issued from the mode decoder (MD), the normal address translation is inhibited, i.e. the destination or origin of any data transfer from the CPU will now be the index register XRO of the MCU. Because the actual instruction is an SD instruction (Store Data), the CPU issues an write signal (W) to the MCU, i.e. the logical index value 2 given as an operand of the SD instruction is to be transferred into index register XRO of the MCU. This transfer is performed via the RCU, however. The RCU will thereby perform a range check and conversion, utilising the LL and NOV values of table entry 3 in the manner described in the associated patent application. As a resulkt of this range conversion, the value actually stored in XRO will be the (logical value - the LL-value) or 2-1 « 1, thereby normalising the index value inside the range 0-2 in this particular case.

When the LD instruction is executed by the CPU, the virtual address with offset - 3 will be issued on the address bus (ABUS) without any modification. If the Data Descriptor Table in Figure 20 is used then the address will be translated by the MCU as SZ(3)*XR0 + BA(BA(3)) = 1*176 + BA(4) - 11//0 + X+2//0 - X+13//0, i.e. the real word address issued on the secondary address bus will be ■X+13 with the bit address issued to the MSU being 0 and the data length being 8. The 8 least significant bits of the addressed memory word will thus be read. If instead the Data Descriptor Table of Figure 22 had been used then th address would have been translated as SZ(3)*XR0 + BA(BA(3)) « 1*8 + BA(4) - 0//8 + X+4//0 « X+4//8, i.e. the real word address issued on the secondary address bus (ABUS2) would have been X+4 with the 8 most significant bits of the word to be read.

The RCU will, in both cases, check that the value held by the 8 transferred bits are within the range 0-100, i.e. the value eventually transferred back to and held in the DR register of the CPU will always be an in-range value. The two last SD instructions follow the same pattern, i.e. the first transfer the logical index value 2 to the index register XR1 of the MCU, which value is normalised by the RCU to the value 1 before stored in . XR1, and the second one translates the virtual address (offset 16) into the physical memory address X+34//8.

Without the invention the address calculations would have to be explicitly performed including any necessary range checking and conversions. A possible example of code without the MCU equivalent in function to the two first instrucions with the MCU generated by the statement:

R(2) := 0(2).B

could, for instance be :-

LD DRO, 2 — Load logical index value

SUB DRO, 1 — Normalise index value . . . — Eventual range checking

— code

MUL DRO, 176 — Multiply index value by

— size of array element LD DR1. DR0 ^■— Copy DRO to DR1 AND DR1.4H000F -- Mask Bit Address within

— word

SHR DRO, 4 — Form word index , —

— into DR2

SHR DR2. DR1 — Shift correct bit

— position of data LD DR3, βMASKWORO* ( DR 1 )

— Load actual Mask word. AND DR2. DR3 — Mask actual bits

— Eventual range checking

— code — At this stage DR2 holds

— the actual information

With an MCU according to the invention a considerable reduction in the complexity and amount of code required for the CPU will thus be obtained with a corresponding reduction in program volumes. Secondly it should be evident that the translation of high level language programs into machine code will be equally simplified, leading to much simpler and more efficient compilers.

Claims

CLAIMS:

1. A computer having a central processor, main memory means for storage of information in binary form in real addresses in the memory, the processor issuing virtual addresses and a master controller being provided for converting virtual addresses issued by the processor into real addresses in the main memory the master controller incorporating means for performing any address calculation or index multiplication independent of any program function.

2. A computer as claimed in claim 1 wherein the master controller has a memory containing a data description table having means for each accessible- address in main memory means for converting a virtual address to the corresponding real address in the memory.

3. A computer as claimed in claim 2 wherein the data descriptor table has at least one table entry for each individually accessible data element in the main memory, three elements of each description table entry being assigned for virtual address translation purposes, one of which elements permits either one out of a set of internal index registers of the master control unit to be indicated for participation in the address translation or indicates that none of these index registers participates in said translation, the second of which elements permits the starting address in the main memory to be specified in the case that no index register participates in the address translation and permits a secondary table entry to be indicated in the case that an index register participates in the address translation, and the third of which elements permits the size of the element to be accessed to be specified in the case that an index register does not participate in the address translation and permits the size of an element to participate in an index multiplication to be specified in the case when an index register does participate.

4. A computer as claimed in claim 3 wherein the master control unit also includes two decoders, the first one of which allows one of the index registers of the master control unit to be selected or indicates that none is selected and the second of which allows the activities performed by the master control unit to be controlled, and further includes two arithmetic circuits, one of which performs an index multiplication of the contents of the index register indicated by the output of the first decoder by the contents of the third element of the currently indicated descriptor table entry in a cumulative fashion so that the resulting value is added to the result of a previous index multiplication within the same address translation, and the other of which arithmetic circuits either performs the addition of the actual start address held in the second element of a descriptor table entry to the result of the first arithmetic circuit if no index register is indicated by the first element of the indicated description table entry or causes the address translation to be continued in a cumulative fashion with the table entry indicated by the second element of the current descriptor table entry.

5. A computer according to claim 4 wherein the real address obtained from the second arithmetic circuit is a word address to the associated main memory.

6. A computer according to claim 4, wherein the real address obtained from the second arithmetic circuit is a bit address to a bit with an identified bit position within a data element stored in the main memory.

7. A computer system according to claim 6 wherein the real address is split into a word address part and a bit address part, the word address part being issued by the master control unit to access a memory word of the main memory and the bit address part together with the size of an element specified by the third element of the currently indicated descriptor table entry being used to control a mask and shift unit in such a manner that any transfer of information from the main memory to the central processing unit is presented to the central processing unit in an adjusted format with filled-in zeroes regardless of the bit positions within an actual memory word in the main memory occupied by a particular data element and such that any transfer of information from the central processing unit is presented to the mask and shift unit of the master control unit in the same adjusted format with or without filled-in zeroes and the mask and shift unit automatically inserts all relevant bits into the correct bit positions within the addressed memory word in the main memory.

8. A computer according to claim 6 or claim 7 wherein the identified bit position is the last significant bit.

9. A computer according to claim 6 or claim 7 wherein the identified bit position is the most significant bit.

10. A computer according to claim 6 or claim 7 wherein the format is right-adjusted with leading zeroes filled in.

11. A computer according to claim 6 or claim 7 wherein the format is left adjusted with lagging zeroes filled in.

12. A computer according to any of claims 4 to 11 wherein a third arithmetic circuit is used to permit the values held in any of the index registers belonging to the master control unit to be modified before, during, or after the address translation performed by the master control unit.

13. A computer according to any of claims 1 to 12 wherein a range check and conversion unit is interposed in the data path between the central processing unit and the master control unit, allowing the data values to be operated with their natural values in the central processing units but stored and operated within the main memory and the master^'control unit with the normalised values giving the most efficient storage and performance utilisation, each normalised value corresponding with a unique natural value within the central processing unit.